INTERNSHIP
NOV 2022 — MAY 2023 · 7 mos
Lab Technician
Parul University · Vadodara, Gujarat
CHAPTER 01THE GROUNDWORK
Cables before consoles
I spent the back half of my degree as the person who found out why the third row of machines could not reach the switch. Setting up and troubleshooting networks, switches, routers and lab systems, installing and configuring operating systems, and keeping the environments running so everyone else could do their practical sessions.
Four years of computer science with a cyber security specialisation gave me the theory. The lab gave me the part that does not survive a lecture — what a network looks like when it is misbehaving.
It was not security work. But you cannot investigate traffic you do not understand, and I learned the plumbing before I ever saw an alert.
PICKED UP HERE
- TCP/IP · DNS · HTTP
- Switching & routing
- OS deployment
INTERNSHIP
DEC 2023 — MAR 2024 · 4 mos
Security Analyst (Intern)
TechDefenceLabs Solutions Ltd · Ahmedabad, Gujarat
CHAPTER 02THE OTHER SIDE
Four months learning how things break
My first security role was on the offensive side. Vulnerability assessments across network and system infrastructure — hunting misconfigurations, exposed services and the weaknesses nobody had got round to. Then supporting penetration testing engagements, validating findings and documenting the exploitation path so somebody could actually fix it.
It is also where I met a SIEM for the first time, correlating log data to validate findings and reconstruct what had happened.
Every defender should spend a season attacking. You stop asking whether an alert is real and start asking what you would do next if it were you.
PICKED UP HERE
- Vulnerability assessment
- Pentest support
- Log analysis
INTERNSHIP
APR 2024 — OCT 2024 · 7 mos
SOC Analyst (Intern)
TechDefenceLabs Solutions Ltd · Ahmedabad, Gujarat
CHAPTER 03FIRST QUEUE
The queue becomes mine
I moved to the blue side and inherited an alert queue. Monitoring and triaging with Splunk and other SIEM tooling, correlating logs against network traffic to work out which anomalies mattered, and escalating confirmed incidents with the evidence attached — because a senior analyst should never have to redo your investigation to trust it.
I also started contributing to detection and response playbooks, writing down the recurring scenarios so the next analyst did not have to rediscover the steps. That instinct turned out to be the rest of my career. My B.Tech finished in April, in the middle of all this.
Most alerts are noise. The entire craft is finding the one that is not, fast, without going numb to the other two hundred.
PICKED UP HERE
- Alert triage
- Escalation discipline
- Splunk
- Playbook writing
FULL TIME · CURRENT
NOV 2024 — PRESENT · 2 yrs
Cybersecurity Engineer & SOC Analyst
Amazure Technology Pvt Ltd · Pune, Maharashtra
CHAPTER 04SCALE
Five thousand endpoints
The step up was from watching the sensors to owning them. I administer and fine-tune CrowdStrike Falcon across an enterprise endpoint fleet — agent installation, configuration and the deeply unglamorous troubleshooting that keeps detection coverage continuous.
The volume changed completely too: a high-volume alert queue across endpoint and SIEM platforms in a 24x7 multi-customer MSSP, where every tenant has different tolerances, different baselines and different people to wake up. I certified as a Falcon Administrator to stop guessing at the platform.
A Falcon agent that quietly stopped reporting three weeks ago is a blind spot nobody has an alert for. Fleet health is detection.
PICKED UP HERE
- Falcon administration
- CCFA
- EDR policy tuning
- High-volume triage
- Multi-tenant MSSP
CHAPTER 052025 · THE TURN
Stop triaging, start automating
Somewhere around the fortieth identical alert, it stopped feeling like the job and started feeling like a bug in the process. So I began building Falcon Fusion SOAR playbooks that run the whole path themselves: triage, enrichment, host isolation on a confirmed true positive, analyst and customer notification, and the report at the end. Mean time to respond came down and so did analyst workload.
The same instinct went into detection rules. I set up a GitHub repository as the source of truth for SIEM detection logic — reviewable history, rollback, and per-tenant tuning on deploy, so one customer's noisy application never becomes everyone's baseline.
If I can write down exactly how I would handle it, a playbook can handle it. My attention should go to the cases where I do not know yet.
PICKED UP HERE
- Falcon Fusion SOAR
- FALCON 114 / 115
- Detection-as-code
- SIEM Engineer
- Auto-containment
CHAPTER 062025 — 2026 · UPSTREAM
Moving ahead of the alert
Automation buys time, and I spent it moving earlier in the chain. I designed and implemented identity-based conditional access policies across customer environments, so a stolen password on its own stops being enough — evaluated against device, location and risk at sign-in, with ITDR covering the sessions that still get through.
I also evaluate and onboard new products into our monitoring workflows — WatchGuard and Kitecyber — run recurring security audits across endpoint and cloud, and write the incident and risk reports that go to customer stakeholders. That last part taught me something the technical work did not: a finding nobody funds the fix for is a finding that did not land.
The cheapest incident is the one that fails at the front door and never becomes a ticket at all.
PICKED UP HERE
- Conditional Access
- ITDR
- ITSEC 121 / 122
- SC-200
- Stakeholder reporting
CHAPTER 07NOW
Where I am pointing next
The current question I am chasing: how much of an investigation can an agent actually carry? I have run lab and POC work with CrowdStrike's Falcon MCP Server, and I am building a SOCRadar-based MCP server that enriches SIEM alert data with threat-intelligence context, so an analyst sees reputation and campaign detail inside the alert instead of pivoting to a second console mid-triage.
Alongside it: CrowdStrike AIDR, the Multi-Cloud Blue Team Analyst certification to push the same discipline across cloud environments, and C3SA from CyberWarFare Labs. The direction of travel is detection engineering at scale — fewer humans reading the same alert twice, more of them working the cases that actually need a person.
I am deliberately scoping the agent work as evaluation, not production. Knowing the limits is the deliverable.
PICKED UP HERE
- Falcon MCP Server
- SOCRadar MCP Server
- CrowdStrike AIDR
- MCBTA
- C3SA